EnxDev commented on code in PR #45166:
URL: https://github.com/apache/superset/pull/45166#discussion_r4256174816
##########
superset/security/manager.py:
##########
@@ -5431,7 +5433,6 @@ def has_promiscuous_chart_access() -> bool:
# A grant on a semantic view's parent layer covers the view,
# matching SemanticView.raise_for_access (sc-119501).
or self._semantic_layer_grant_allows(datasource)
- or self.is_editor(datasource)
Review Comment:
Dropping this means an editor can no longer query their own dataset without
a datasource, schema or catalog grant. The case I'd worry about is a custom
role with SQL Lab, dataset write and only dataset-level grants: they save a
virtual dataset, become its editor, hold no grant on the new dataset's perm,
and get an access error opening it in Explore. Unless I'm missing a grant that
gets created along the way.
That has worked since the owner days, so if it's intended it needs an
`UPDATING.md` entry and a word on what existing deployments should do.
##########
superset/security/manager.py:
##########
@@ -5363,11 +5363,13 @@ def raise_for_access( # noqa: C901
catalog=effective_catalog,
)
for datasource_ in datasources:
+ # Table access derives from a datasource_access grant on a
Review Comment:
A couple of places outside this diff still lean on the old rule. The
soft-delete leg of `DatasourceFilter` in `superset/views/base.py` and the
lookup in `superset/commands/restore.py` both justify themselves with
"`raise_for_access` counts editorship as datasource access".
After this, an editor can still see and restore a trashed dataset they can't
open. Those comments, and probably that behaviour, need a look in the same PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
